ClawHub
Back to skill

Security audit

ARCHIV

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a Roon music-control skill, but it also ships unrelated long-term memory with credential locations, private local details, and persistence notes that users should review before installing.

Install only after removing or sanitizing MEMORY.md and narrowing the activation language to explicit Roon or music-control requests. Verify the zone IDs, and treat Play Now, volume changes, and transport controls as live actions that may interrupt the current listening session.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The file says not to store API keys in memory files, yet it documents exact credential file locations for services such as Trakt and Last.fm. Publishing where secrets live materially helps an attacker or a compromised agent locate and target credential stores, especially when paired with other filesystem or exec capabilities.

Vague Triggers

High
Confidence
95% confidence
Finding
The skill advertises extremely broad trigger phrases such as casual everyday language like 'put something on', 'skip this', and 'turn it up', which can cause the skill to activate outside a clearly scoped Roon intent. Because this skill can immediately control playback, volume, and queues across named zones, accidental invocation can trigger unintended actions on a real home audio system.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The instructions state that 'Play Now' clears the existing queue but do not require an explicit warning or confirmation before using it. In this context, that can silently destroy the user's current listening session or playlist state, especially when combined with broad triggers and immediate execution guidance.

Static analysis

No suspicious patterns detected.